Authentication method

Abstract

An authentication method and system for mutual authentication between a first entity and a third entity via a second entity, based on an authentication protocol used by the first entity and the third entity. The second entity forwards mutual authentication messages between the first entity and the third entity. An apparatus is configured to perform an authentication method for a mutual authentication between a first entity and a third entity via a second entity, based on an authentication protocol used by the first entity and the third entity, the second entity forwards mutual authentication messages between the first entity and the third entity.

The invention claimed is: 
     
       1. A method to perform a mutual authentication between a first entity and a third entity via a second entity, based on an authentication protocol used by the first entity and the third entity, wherein the second entity forwards mutual authentication messages between the first entity and the third entity, the method comprising:
 a) starting mutual authentication by frontloading, by the third entity, a first part of an authentication protocol to the second entity and keeping at least a missing part of the authentication protocol at the third entity, the frontloaded first part of the authentication protocol comprising a first encrypted number and generating a second encrypted number by the first entity, the second encrypted number comprising content of the first encrypted number; 
 b) receiving, by the third entity from the second entity, a wake-up signal to the third entity and an indication to continue the mutual authentication between the first entity and the second entity and rerouting, by the second entity, the mutual authentication messages, when the third entity woke up from Low Power Mode, the rerouting comprising transmitting the second encrypted number from the second entity to the third entity; and 
 c) continuing, by the third entity, the mutual authentication between the first entity and the third entity based on the missing part of the authentication protocol, continuing after receiving the second encrypted number from the second entity, the missing part of the authentication protocol comprising instructions for the third entity to derive a session key based on the second encrypted number and instructions for the first entity to derive a session key based on a third encrypted number generated and transmitted by the third entity, the third encrypted number comprising content of the second encrypted number, and using the respective session keys by the first entity and the third entity to exchange authenticated messages between the first entity and the third entity. 
 
     
     
       2. A method to perform a mutual authentication between a first entity and a third entity via a second entity, based on an authentication protocol used by the first entity and the third entity, wherein the second entity forwards mutual authentication messages between the first entity and the third entity, the method comprising:
 a) receiving, by the second entity a frontloaded first part of an authentication protocol and keeping at least a missing part of the authentication protocol at the third entity, the frontloaded first part of the authentication protocol comprising a first encrypted number and the third entity, turning from a High Power Mode into a Low Power Mode after frontloading the first part of the authentication protocol; 
 b) starting, by the second entity, the mutual authentication between the third entity and the first entity based on the frontloaded first part of the authentication protocol, when a first entity connects to the second entity, and generating a second encrypted number by the first entity, the second encrypted number comprising content of the first encrypted number and sending, by the second entity, a wake-up signal to the third entity; 
 c) rerouting, by the second entity, the mutual authentication messages, when the third entity woke up from Low Power Mode, to the third entity, the rerouting comprising transmitting the second encrypted number from the second entity to the third entity; 
 d) switching the third entity from a low power mode to a second power mode higher than the low power mode; and 
 e) continuing mutual authentication, by the third entity, after the third entity receives the second encrypted number from the second entity, the missing part of the authentication protocol comprising instructions for the third entity to derive a session key based on the second encrypted number and instructions for the first entity to derive a session key based on a third encrypted number generated and transmitted by the third entity, the third encrypted number comprising content of the second encrypted number, and using the respective session keys by the first entity and the third entity to exchange authenticated messages between the first entity and the third entity. 
 
     
     
       3. A vehicle comprising:
 a second entity comprising memory and configured to
 a) receive, by the second entity a frontloaded first part of an authentication protocol, the frontloaded first part of the authentication protocol comprising a first encrypted number; 
 b) start, by the second entity, mutual authentication between a third entity and a first entity based on the frontloaded first part of the authentication protocol, when the first entity connects to the second entity, and generating a second encrypted number by the first entity, the second encrypted number comprising content of the first encrypted number; and 
 c) reroute, by the second entity, when the third entity wakes up from Low Power Mode, the mutual authentication messages to the third entity, the rerouting comprising transmitting the second encrypted number from the second entity to the third entity and update a part of the authentication protocol received from the third entity; and 
 
 the third entity comprising memory and configured to:
 a) frontload, by the third entity, a first part of an authentication protocol to the second entity and keeping at least a missing part of the authentication protocol at the third entity, the frontloaded first part of the authentication protocol comprising a first encrypted number and the third entity, turning from a High Power Mode into a Low Power Mode after frontloading the first part of the authentication protocol; 
 b) receive, by the third entity from the second entity, an indication to continue the mutual authentication between the first entity and the third entity, and switch the third entity from a low power mode to a second power mode higher than the low power mode; and 
 c) continue, by the third entity, the mutual authentication between the first entity and the second entity based on the missing part of the authentication protocol, after receiving a second encrypted number from the second entity, the second encrypted number comprising content of the first encrypted number, the missing part of the authentication protocol comprising instructions for the third entity to derive a session key based on the second encrypted number and instructions for the first entity to derive a session key based on a third encrypted number generated and transmitted by the third entity, the third encrypted number comprising content of the second encrypted number, and continuing comprising using the respective session keys by the first entity and the third entity to exchange authenticated messages between the first entity and the third entity. 
 
 
     
     
       4. The method of  claim 1 , further comprising switching the third entity from a low power mode to a second power mode higher than the low power mode. 
     
     
       5. The method of  claim 1 , wherein the session key is not stored at the second entity.